Legal document
Cookie Policy
Last updated: 5 November 2026.
This page lists the cookies and storage the site really uses. They keep the site working: language, the cookie notice, a proposal session and, at payment, Stripe fraud prevention. They are not used for advertising or audience measurement.
How we handle personal data is in the Privacy Policy.
Public site
On any public page.
mba-cookie-consent
- Type
- Local storage (localStorage)
- Where
- Public site, in this browser.
- Why
- Remembers the notice choice (accept or reject) so it is not shown again. Accepting does not load statistics: no analytics script is configured.
- How long
- Until you delete the site data.
mba-locale
- Type
- Local storage (localStorage)
- Where
- Public site, in this browser.
- Why
- Stores the language you chose, or the one detected on the first visit, so later pages open in that language.
- How long
- Until you delete the site data.
mba-locale-auto
- Type
- Session storage (sessionStorage)
- Where
- Public site, in this tab.
- Why
- Marks that automatic language detection already ran, so the language is not switched again on the same visit.
- How long
- Until you close the tab.
mba-intro
- Type
- Session storage (sessionStorage)
- Where
- Public site, in this tab.
- Why
- Marks that the “Welcome” introduction has already been shown, so it is not repeated.
- How long
- Until you close the tab.
Proposal and payment
Only on a proposal link (/p/…). Visiting the public site does not create these. Stripe cookies appear when the payment step loads Stripe.js.
mba_p
- Type
- Cookie
- Where
- Requests to /api/p/, after you open a proposal. HttpOnly, Secure, SameSite=Lax. Page JavaScript cannot read it.
- Why
- Signed session after you confirm the last digits of the phone number, so that check is not repeated.
- How long
- 1 hour.
mba:draft:v1:…
- Type
- Local storage (localStorage)
- Where
- Proposal page, in this browser. The name ends with a short identifier of the link, not the full token.
- Why
- Draft of the form: name, tax identifier, email, phone, country and the acceptance box, so what you typed is not lost.
- How long
- 24 hours. It is also deleted when the proposal is accepted.
mba-portal-intro
- Type
- Session storage (sessionStorage)
- Where
- Proposal page, in this tab.
- Why
- Marks that the proposal introduction has already been shown.
- How long
- Until you close the tab.
__stripe_mid
- Type
- Cookie
- Where
- On the site domain, path /, SameSite=Strict. Only when payment loads Stripe.js.
- Why
- Stripe fraud prevention (browser identifier). Stripe sets it, not our server.
- How long
- 1 year.
__stripe_sid
- Type
- Cookie
- Where
- On the site domain, path /, SameSite=Strict. Only when payment loads Stripe.js.
- Why
- Stripe fraud prevention (payment-session identifier).
- How long
- 30 minutes.
The proposal security check (Cloudflare Turnstile) does not set a cookie of ours. It returns a single-use code, which the server checks. The site code does not ask for the cf_clearance cookie.
Administration
Only for someone who opens /admin, which is protected by Cloudflare Access. A normal visit to the site does not create these cookies.
CF_AppSession
- Type
- Cookie
- Where
- On this domain, path /, Secure and HttpOnly, when someone opens /admin.
- Why
- Keeps the Cloudflare Access session and protects sign-in. A visit to the public site does not create it.
- How long
- 24 hours.
CF_Authorization
- Type
- Cookie
- Where
- On this domain, after you sign in through Cloudflare Access.
- Why
- Proof that the session may open /admin. Without it, Access does not let the request through.
- How long
- The duration set in Access. If none is set, Cloudflare’s default is 24 hours.
What we do not use
We do not use analytics cookies. Plausible, Google Analytics and any other meter are not connected.
We do not use advertising cookies or social-network pixels.
Fonts are served from our own domain. There is no request to Google Fonts.
How to delete them
In the browser settings, delete cookies and site data for madebyatlantic.com. Closing the tab clears sessionStorage. If you delete mba-cookie-consent, the notice appears again.
Contact
Questions: [email protected].